Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/05/2024, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe
Resource
win10v2004-20240508-en
General
-
Target
89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe
-
Size
4.1MB
-
MD5
ac39cc59f904c244028080be95a6e903
-
SHA1
12409ac3d16d2c95af9fd20dfde3a6c0d7bdd573
-
SHA256
89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e
-
SHA512
a82370e71a98da5adab169595bd6f362362395f894f6485439462e2705f6d8a181a9cc1c6bfe84a6879d125d67f4148c7831c5899d5f13637c8dce8acaec690b
-
SSDEEP
98304:j3/aXnuKq8lIi6YuYM5DOP1Yy/qFVYXqnggvBm2Aw6XSjras4uEiZDLpDRiiTP:j3/aer8lIiPc9ySnggpxAJiIuBVpFiir
Malware Config
Signatures
-
Glupteba payload 19 IoCs
resource yara_rule behavioral2/memory/976-2-0x00000000048C0000-0x00000000051AB000-memory.dmp family_glupteba behavioral2/memory/976-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/976-134-0x00000000048C0000-0x00000000051AB000-memory.dmp family_glupteba behavioral2/memory/976-132-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/976-192-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3228-191-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-199-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-210-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-214-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-218-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-222-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-226-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-230-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-234-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-238-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-242-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-246-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-250-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba behavioral2/memory/3004-254-0x0000000000400000-0x0000000002738000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3152 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 3004 csrss.exe 656 injector.exe 2944 windefender.exe 1880 windefender.exe -
resource yara_rule behavioral2/files/0x000200000002aa22-202.dat upx behavioral2/memory/2944-205-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1880-207-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2944-208-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1880-212-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1880-220-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1880-232-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe File created C:\Windows\rss\csrss.exe 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3120 sc.exe -
pid Process 2020 powershell.exe 4664 powershell.exe 1520 powershell.exe 3508 powershell.exe 4968 powershell.exe 4176 powershell.exe 2268 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2296 schtasks.exe 224 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1520 powershell.exe 1520 powershell.exe 976 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 976 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 3508 powershell.exe 3508 powershell.exe 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 4968 powershell.exe 4968 powershell.exe 4176 powershell.exe 4176 powershell.exe 2268 powershell.exe 2268 powershell.exe 2020 powershell.exe 2020 powershell.exe 4664 powershell.exe 4664 powershell.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 3004 csrss.exe 3004 csrss.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 3004 csrss.exe 3004 csrss.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 3004 csrss.exe 3004 csrss.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe 656 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 976 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Token: SeImpersonatePrivilege 976 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe Token: SeDebugPrivilege 3508 powershell.exe Token: SeDebugPrivilege 4968 powershell.exe Token: SeDebugPrivilege 4176 powershell.exe Token: SeDebugPrivilege 2268 powershell.exe Token: SeDebugPrivilege 2020 powershell.exe Token: SeDebugPrivilege 4664 powershell.exe Token: SeSystemEnvironmentPrivilege 3004 csrss.exe Token: SeSecurityPrivilege 3120 sc.exe Token: SeSecurityPrivilege 3120 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 976 wrote to memory of 1520 976 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 83 PID 976 wrote to memory of 1520 976 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 83 PID 976 wrote to memory of 1520 976 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 83 PID 3228 wrote to memory of 3508 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 88 PID 3228 wrote to memory of 3508 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 88 PID 3228 wrote to memory of 3508 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 88 PID 3228 wrote to memory of 2468 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 90 PID 3228 wrote to memory of 2468 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 90 PID 2468 wrote to memory of 3152 2468 cmd.exe 92 PID 2468 wrote to memory of 3152 2468 cmd.exe 92 PID 3228 wrote to memory of 4968 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 93 PID 3228 wrote to memory of 4968 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 93 PID 3228 wrote to memory of 4968 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 93 PID 3228 wrote to memory of 4176 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 95 PID 3228 wrote to memory of 4176 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 95 PID 3228 wrote to memory of 4176 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 95 PID 3228 wrote to memory of 3004 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 97 PID 3228 wrote to memory of 3004 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 97 PID 3228 wrote to memory of 3004 3228 89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe 97 PID 3004 wrote to memory of 2268 3004 csrss.exe 98 PID 3004 wrote to memory of 2268 3004 csrss.exe 98 PID 3004 wrote to memory of 2268 3004 csrss.exe 98 PID 3004 wrote to memory of 2020 3004 csrss.exe 104 PID 3004 wrote to memory of 2020 3004 csrss.exe 104 PID 3004 wrote to memory of 2020 3004 csrss.exe 104 PID 3004 wrote to memory of 4664 3004 csrss.exe 106 PID 3004 wrote to memory of 4664 3004 csrss.exe 106 PID 3004 wrote to memory of 4664 3004 csrss.exe 106 PID 3004 wrote to memory of 656 3004 csrss.exe 108 PID 3004 wrote to memory of 656 3004 csrss.exe 108 PID 2944 wrote to memory of 2280 2944 windefender.exe 114 PID 2944 wrote to memory of 2280 2944 windefender.exe 114 PID 2944 wrote to memory of 2280 2944 windefender.exe 114 PID 2280 wrote to memory of 3120 2280 cmd.exe 115 PID 2280 wrote to memory of 3120 2280 cmd.exe 115 PID 2280 wrote to memory of 3120 2280 cmd.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe"C:\Users\Admin\AppData\Local\Temp\89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe"C:\Users\Admin\AppData\Local\Temp\89dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3152
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2296
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2032
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:656
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:224
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1880
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD56ddcfbbfe6d4fee9f8cbc5863ea4297e
SHA12b6cd8257b59d693261f5fa5ae73a847fa5c6582
SHA25658f252819a13114dc35cf78da3336ffd558873b8fd683522b83cc0310d086e4a
SHA5122be36ee9aee4ed020bc5b3799ef3f313fd6ae7a4cbeb6acd3abfdca889d2b751c3a80fd1b94ddd781c7d1c204f80856c477b324bf9c5fbfc832a11c79988242d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD54488731be856967e0f4814d2da79a3a8
SHA1faca3ab2a7136a6e10d34ada2eb51b7b8c16f5e7
SHA2569757a25ed0f7325dfbeecfbdfc77f39e85817d6301c5dfd71c25776025461712
SHA5121c30281b96a1c637bd853dcd1ffad2edfa8c68f93cf5bd304a8b88065719a0ab5e1a1cae8dc7bbd02d07286360cc8636090e77b9153ef4671a3d8fa0ed359d24
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5d474ebc6f20d8e370faac14282613353
SHA1e9ec1b506c12683358c9a9908ddba780c8bb7e4b
SHA25671c8e9adf04ef56fc9071ff581397ee99f9b7481ac5af057c051336e27896109
SHA51279b4cef9f05a6918406afa3298402cf27736b6beb064c13fd6a57b663a9f64a6b0da28d0b30eaacff69ebb6adb22c2406082bc31b10c1c58026cb14a7d414742
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD58a22b22469ce345eccc4213427bb6137
SHA144ed406260fdd6ab1aa0925208a0fa540beb3f68
SHA256e406c6bffeb12b1b4f69fdf31672729ef412a8609735dc330787dc90738e6145
SHA51257794d3f7d614a8871a2273ff45388f472cbc1d2f3cfcf374a76a06fdcaebc5321806862c1d0b8633bca382d26ee69c3a0b6ec3eee834ecfa6e1da55ee8e31ca
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD57d9ac70a2d4df4b797dab88ab7c0b411
SHA198352e08e4955f9a7dd7d0a7573138337c66dbb1
SHA256e8fc0b0e6acbef40a7559e1a85bd80ab2ed293b8cf163e9dcc29830c88f21702
SHA512afdac66d904c1aa5da3a081144aff6ec17f5fb4e7688f2b45e4a1eac7d393cfb49fc69b3bde89a527f54971f246528da188ce345a5104763929d13ebafd803f4
-
Filesize
4.1MB
MD5ac39cc59f904c244028080be95a6e903
SHA112409ac3d16d2c95af9fd20dfde3a6c0d7bdd573
SHA25689dc2fadee4471584af48f114cb34548c6015855fc8ab3d6dd8afbe339caa18e
SHA512a82370e71a98da5adab169595bd6f362362395f894f6485439462e2705f6d8a181a9cc1c6bfe84a6879d125d67f4148c7831c5899d5f13637c8dce8acaec690b
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec